proposal-moonwell[.]fi

This domain, proposal-moonwell.fi, is flagged as a high-risk generic phishing threat and remains active as of the report date. Registered on March 23, 2026, through Key-Systems GmbH, it resolves to IP address 188.114.96.3. The domain displays the page title 'Just a moment...' and uses a Let's Encrypt SSL certificate. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3. Threat intelligence sources indicate the domain appears in 23 pulses on AlienVault OTX and is blocked by four security blocklists, including SEAL, MetaMask, PhishDestroy, and BLP-Malware. VirusTotal data shows 13 out of 95 security vendors flag this domain as malicious. The Gridinsoft trust score is 0 out of 100, reinforcing its malicious classification. The exact content of the site has not been analyzed, so the specific phishing lure or brand impersonated remains unknown. Defenders should treat this domain as actively malicious, block it at network and email gateways, and monitor for any related infrastructure sharing the same IP or registration details.